# LangChain MongoDB chat history: query injection crosses sessions

> A structured session identifier became a MongoDB query condition in @langchain/mongodb, reaching other users' stored conversations.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** LangChain
- **Disclosed:** 2026-10-05
- **CVE:** CVE-2026-106119
- **CVSS:** 6
- **Affects:** @langchain/mongodb
- **Research by:** iaohkut-from-NightWolf-Team
- **Primary source:** https://github.com/advisories/GHSA-m6rx-h84q-8r95
- **Page:** https://theinjection.dev/items/langchain-mongodb-chat-history-query-injection/

CVE-2026-106119 lets an attacker who controls a session identifier read, change or delete another user's chat history in @langchain/mongodb. The library passed the identifier into a MongoDB query without enforcing a string type.

## What happened

LangChain published advisory GHSA-m6rx-h84q-8r95 for the @langchain/mongodb package on October 5, 2026. Credit for the report goes to iaohkut-from-NightWolf-Team. The affected versions, the fixed release and the assigned identifiers are listed below.

## How it works

MongoDBChatMessageHistory did not enforce the string type for session identifiers at runtime, so a structured value was interpreted as a MongoDB query condition rather than a literal. An attacker who supplies such an identifier can match documents beyond the intended session and then read, modify or delete those messages. The patch rejects session identifiers that are not strings and wraps query filters in the $eq operator so values compare literally.

## Who is affected

Applications built on @langchain/mongodb 1.3.0 and earlier are exposed when they pass untrusted session identifiers to MongoDBChatMessageHistory and keep several users' histories in one collection. Deployments that derive identifiers server-side from authenticated values are not reachable through this flaw.

## What to do

Upgrade @langchain/mongodb to 1.3.1. Where an upgrade has to wait, reject any session identifier that is not a non-empty string, and derive identifiers from authenticated, server-controlled values instead of untrusted request fields. Note that 1.3.1 turns an empty-string session identifier into an error.

## Quick facts

- **Affected:** @langchain/mongodb 1.3.0 and earlier
- **Fixed in:** 1.3.1
- **CVE:** CVE-2026-106119
- **CVSS:** 6.0 base, CVSS v4, moderate
- **Found by:** iaohkut-from-NightWolf-Team
- **Weakness:** CWE-943, improper neutralization of special elements in data query logic

## Sources

1. [GitHub Advisory](https://github.com/advisories/GHSA-m6rx-h84q-8r95)
2. [Release 1.3.1](https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fmongodb%401.3.1)